Описание
Path Traversal in Beego
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2022-31836
- https://github.com/beego/beego/issues/4961
- https://github.com/beego/beego/pull/5025
- https://github.com/beego/beego/pull/5025/commits/ea5ae58d40589d249cf577a053e490509de2bf57
- https://github.com/advisories/GHSA-95f9-94vc-665h
- https://pkg.go.dev/vuln/GO-2022-0569
Пакеты
Наименование
github.com/beego/beego
go
Затронутые версииВерсия исправления
< 1.12.11
1.12.11
Наименование
github.com/beego/beego/v2
go
Затронутые версииВерсия исправления
>= 2.0.0, < 2.0.4
2.0.4
Связанные уязвимости
CVSS3: 9.8
nvd
больше 3 лет назад
The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.